Capture Email Importance and translate to Priority

Question

Is there a way, and how would I capture the importance of an email and assign an alert priority to it. We've routed emails coming to a team mailing list to an OpsGenie email integration so that we capture when someone makes a request or reports an issue it's captured. Working towards the goal of our OpsGenie alert queue being the holder of all "issues" we're working on. If someone sends an email with the importance of "high" that's part of the incoming data headers but I'd like to create an action filter based on that and don't see a way to do it. This is an example of the incoming data - I want to filter on "IMPORTANCE": "high" "_headers": { "MESSAGE-ID": "", "ACCEPT-LANGUAGE": "en-US", "IMPORTANCE": "high", "DKIM-SIGNATURE": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=XXXX.com; h=from : to : subject : date : message-id : content-type : mime-version; s=PPS12042020; bh=byGU3yumHR5BXM6XEDfjF9EUFPfGOygeCeCeMVgRCZ0=; b=U3inql5+jFtPZBlnJRp8jvctNE3b4Qdte7OJet64xWj2edIwyM+rRsalu9YLZEhD+kOk PO641skAcY2Pt71x6sa5D2SbBdgSDu5xRfbm75nwYb9rXJinQ/qfvR9C2pc1AUbtydJp eyUWddokKxWdRApPklNJHzNKlx5df3fY0enMWiGVIyXLtn2Gj0pOwTt7qDIgzJ8/Cd0k hJpnbiQhPG6K7UbkLk7P1XU+Ev275oNFeK0ZjZQ5jMrGIndXC8kleEtjjskIgxJ15k3K m8WhivGNRkejGfYsdVdU9j6wQ+xoI6bcuSqH7DatxJQruZlzwItiJERz/euDXCn5fsNS xw== ", "FROM": ""XXXXXXX, XXXX X." ", "X-PRIORITY": "5", "RECEIVED": "from XXXXXXXXXXXXXXXXXX.com ([xxx.xxx.8.117]) by xxxxxxxxxx.com ([xxx.xxx.8.117]) with mapi id 15.00.1497.015; Thu, 20 May 2021 10:04:00 -0500", "DATE": "Thu, 20 May 2021 15:03:59 +0000", "CONTENT-LANGUAGE": "en-US", "X-MS-TNEF-CORRELATOR": "", "THREAD-INDEX": "AddNiVyy+0llyWGSSMiIPssoIK9VPA==", "X-MS-EXCHANGE-TRANSPORT-FROMENTITYHEADER": "Hosted", "X-ORIGINATING-IP": "[xxx.xxx.x.x]", "CONTENT-TYPE": "multipart/alternative; boundary="_000_15a35d6d79f3405fabe526244568b7a9EX13OWTSRV4feddomadfedi_"", "SUBJECT": "Message Test #3", "TO": "xxxx@xxxx.opsgenie.net", "THREAD-TOPIC": "Message Test #3", "X-MS-HAS-ATTACH": "", "MIME-VERSION": "1.0", "X-TM-AS-GCONF": "00" },

Nick Haller · Accepted Answer

Hi @Eric Sletten ,

You should be able to use a dynamic field to extract that. I believe what you need is:

I'd also assume that might be parsed somewhere in the email - so you could consider using string processing or regex to extract this / other pieces of data:

https://support.atlassian.com/opsgenie/docs/string-processing-methods-in-opsgenie-integrations/

https://support.atlassian.com/opsgenie/docs/regular-expressions-for-improved-alert-filtering/

Hope this helps! Let us know whether or not that works, if you run into other questions, etc.